Your data, plainly explained
Privacy Policy
Effective 15 July 2026 · khayrun.app
- We collect what the app and website need to work, and nothing for advertising.
- Your location becomes prayer times. We never store your precise coordinates.
- Your app data lives in the EU. We never sell it.
- Delete your account in the app and everything goes with it.
1. Who is responsible
Khayrun is built and operated by Sayid Bilal, based in the Netherlands. He is the data controller under the EU General Data Protection Regulation (GDPR). For anything in this policy, email care@khayrun.app.
2. What we collect, and why
| Data | Why |
|---|---|
| Email address, or your Google account email if you sign in with Google | Your account and sign-in codes. Marketing email, Sayid's dawn letters, only if you explicitly opt in during onboarding. The box is never pre-ticked, and you can opt out at any time. |
| Display name and avatar, either an illustrated preset or a photo you upload | How other users see you on the feed and leaderboards. |
| Location | Calculating your Fajr and sunrise times. Your device's coordinates are rounded before they reach us. We also derive your city and country for the local leaderboard. We never store precise coordinates and never show anything below city level. |
| Timezone and calculation method | Getting your prayer times right. |
| Check-ins, streaks, and points | The core of the app: your wake-up and prayer confirmations, and the numbers built from them. |
| What you post: feed text, photos, likes, reports, and blocks | Running the community. Photos are re-encoded on your device before upload, which strips hidden metadata, including GPS tags. |
| Onboarding answers | Setting sensible defaults and knowing where to spend our effort. These answers do not gate anything. |
| Usage events, such as screens visited and core actions | Understanding which parts of the app work. PostHog processes these events on EU servers, tied to a random account ID and never your name, email, or handle. There is no session recording, advertising SDK, or advertising. |
| Website visit data, such as page, referrer, approximate region, browser, and device type | Understanding aggregate website traffic. Vercel Web Analytics records anonymous page views without third-party cookies and does not associate them with an individual, account, or IP address. We do not send account identifiers or custom events. |
| Support email you send to care@ | Answering you. |
3. A note on religious data
Khayrun is a prayer app. Simply by using it, your data, including check-ins, streaks, and posts, reveals your religious practice. This is a special category of personal data under GDPR Article 9. We process it on the basis of your explicit consent, which you give by creating an account and can withdraw at any time by deleting your account in the app. We use this data to run the app for you, and for nothing else.
4. Legal bases
- Contract: providing the app you signed up for, including your account, prayer times, streaks, and community.
- Explicit consent: the religious dimension described above, device location access requested in onboarding, and marketing email if you opt in.
- Legitimate interest: keeping the community safe through moderation and abuse prevention, plus minimal telemetry to improve the app.
5. Where your data lives, and who processes it
Your app account data is stored in the European Union, in AWS eu-west-1 in Ireland. Anonymous website analytics are processed separately by Vercel. We use a small set of processors, each doing one job:
| Service | Job |
|---|---|
| Supabase | Database, authentication, and photo storage in the EU region |
| Resend | Delivering sign-in code emails and dawn letters if you opted in |
| PostHog | Product analytics in the EU region |
| Vercel | Hosting this website and providing anonymous, cookie-free website analytics |
| Optional Sign in with Google and app distribution via Google Play | |
| Expo (EAS) | Delivering app updates |
| Cloudflare | DNS and email routing |
Where a processor operates outside the EU, transfers are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses. We do not sell personal data to anyone, and there are no advertising partners or ads.
6. What other users see
Other signed-in users can see your display name, avatar, city and country, streak and days-completed numbers on leaderboards, and anything you post to the feed. They never see your email, coordinates, timezone, or whether your streak is paused. A paused streak simply appears held.
7. Retention and deletion
- Your data is kept while your account exists.
- Delete your account in the app through Settings → Delete account, and your profile, check-ins, streaks, points, posts, photos, likes, and events are permanently deleted. This is immediate and irreversible.
- Vercel Web Analytics is anonymous and is not linked to your Khayrun account. Its temporary visitor session is discarded after 24 hours.
- Reports you filed against removed content may be kept in anonymized form for moderation integrity.
- Cannot access the app? Follow the steps on the account deletion page. Deletion by email works too.
8. Your rights
Under the GDPR, you can ask for access, correction, deletion, portability, or restriction of your data, and object to processing based on legitimate interest. Most of this you can do in the app. For the rest, email care@khayrun.app and we will respond within 30 days. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
9. Age
Khayrun is not directed at children. You must be 16 or older, the Dutch GDPR consent age, to create an account.
10. Changes
If this policy changes in a way that matters, we will say so in the app before it takes effect. The current version always lives at khayrun.app/privacy.